CVE-2017-20148: 
Linux Gentoo vulnerability analysis and mitigation

CVE-2017-20148 affects the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo. The vulnerability was discovered and disclosed on September 20, 2022. The issue exists in the package's post-installation phase where insecure recursive chown calls could lead to privilege escalation (CVE Details, Gentoo Security).

The vulnerability exists in the pkg_postinst phase of the Logcheck ebuilds, which recursively executes chown on the /etc/logcheck and /var/lib/logcheck directories. While the first installation is safe, the logcheck user can subsequently place a hard link in either of these directories pointing to sensitive files (e.g., /root/.bashrc). During subsequent installations, the ebuild's chown call will follow the link and transfer ownership of the linked file to the logcheck user (Gentoo Bug).

A local attacker with access to the logcheck user could exploit this vulnerability to escalate privileges to root level, potentially gaining complete system access (Gentoo Security).

Gentoo has discontinued support for Logcheck due to this vulnerability. The recommended mitigation is to completely remove the package using the command: emerge --ask --depclean "app-admin/logcheck" (Gentoo Security).